Security Architecture and Engineering
Security Architecture and Engineering tests secure design principles, security models, trusted computing, and cryptographic architecture. Expect questions that ask which model enforces confidentiality versus integrity, how a reference monitor behaves, and what evaluation assurances mean.
Core rules and concepts
- Secure design principles include least privilege, defense in depth, fail-safe defaults, complete mediation, separation of duties, economy of mechanism, open design, and least common mechanism.
- Bell-LaPadula enforces confidentiality: no read up, no write down (simple and star properties). Biba enforces integrity: no read down, no write up. Clark-Wilson enforces integrity through well-formed transactions and separation of duties. Brewer-Nash (Chinese Wall) prevents conflicts of interest.
- The trusted computing base (TCB) is the set of components that must be trusted. A reference monitor must be tamperproof, always invoked, and verifiable; it mediates all accesses.
- Common Criteria EALs describe assurance depth, not absolute security. Cryptography provides confidentiality, integrity, authentication, and nonrepudiation, but not availability by itself.
Worked example
A system stores Secret and Top Secret documents. A Secret-cleared analyst must not read Top Secret, and a Top Secret analyst must not write down to Secret. Bell-LaPadula fits: no read up blocks the first; no write down blocks the second. If the requirement were “users must not corrupt higher-integrity data,” Biba would fit instead: no write up and no read down. Choosing BLP for integrity would be a category error.
Traps
Reversing BLP and Biba directions; treating an EAL as a guarantee that a product is secure; assuming open design weakens security; and forgetting that a reference monitor must mediate every access, not just initial logon.